CVE-2026-100610

Executive Summary

CVE-2026-100610 is an authorization bypass and broken access control vulnerability in Flowise versions through 3.1.4, affecting the endpoints GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history. The flaw allows any authenticated low-privilege user or holder of a valid API key to read or delete document-store upsert history belonging to other users and workspaces without proper ownership or workspace validation, as CVSS v3.1 scores at 7.5. Organizations deploying Flowise for LLM orchestration and retrieval-augmented generation (RAG) pipelines are affected, with potential exposure of embedding configurations, record-manager and vector-store node settings, and integrity impact through unauthorized data deletion.

Technical Analysis

The vulnerability resides in Flowise's upsert history API endpoints, which fail to enforce route-level permission checks. The NVD description identifies two specific endpoints: GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history. The backing service layer lacks workspace or ownership validation, meaning authorization decisions rely solely on the attacker-supplied chatflowid or an array of record UUIDs.

Two service methods are explicitly named in the advisory. getAllUpsertHistory() returns UpsertHistory rows selected exclusively by the attacker-supplied chatflowid parameter, with no check that the requesting user owns or has access to the referenced chatflow. patchDeleteUpsertHistory() deletes rows based on an attacker-supplied array of record UUIDs, again without validating ownership or workspace membership.

The attack surface is significant because chatflowId values are not secret — they are exposed publicly in share links of the form /chatbot/<chatflowId>. An attacker who has observed a share link, browsed a public Flowise instance, or obtained a chatflow ID through other reconnaissance can supply that identifier to the vulnerable endpoints.

The retrievable flowData and result fields contain sensitive configuration for embedding nodes, record-manager nodes, and vector-store nodes, including per-node paramValues. This data may reveal API keys, database connection strings, embedding model endpoints, and internal document indexing structure — all of which are valuable for lateral movement or further targeting of connected infrastructure.

CWE-639 (Authorization Bypass Through User-Controlled Key) accurately describes the flaw: the application trusts a client-supplied key (chatflowid or record UUIDs) as sufficient authorization to access or modify the underlying records. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network exploitable, high attack complexity (requiring knowledge of the target chatflowId or record UUIDs), low privileges required (any authenticated user or valid API key), and high confidentiality and integrity impact due to the data exposure and deletion capabilities.

Because no patched version is available and no patch evidence exists in any tracked source, this remains an unpatched vulnerability in Flowise 3.1.4 and earlier.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639) and the specific endpoints and methods described in the NVD advisory.

1) Reconnaissance and target identification: An attacker identifies a Flowise instance exposed on the network. Because chatflowId values are exposed publicly through share links at /chatbot/<chatflowId>, the attacker can harvest valid chatflow IDs by enumerating public share pages, observing URLs in logs, or obtaining them through social engineering. No authentication is required to retrieve the chatflowId from a public share link.

2) Triggering the authorization bypass: With a valid low-privilege account or API key, the attacker issues a request to GET /api/v1/upsert-history/:id, supplying the :id path parameter — which corresponds to the attacker-supplied chatflowid. Because the route has no permission check and getAllUpsertHistory() returns rows based solely on the supplied chatflowid without workspace or ownership validation, the response returns upsert history rows from other users or workspaces.

3) Data extraction or destruction: The response payload includes the flowData and result fields, which contain embedding, record-manager and vector-store node configuration, including per-node paramValues. The attacker can read this configuration to extract sensitive details about the RAG pipeline. Alternatively, the attacker issues a PATCH /api/v1/upsert-history request with an array of record UUIDs, triggering patchDeleteUpsertHistory(), which deletes the targeted rows without ownership validation, causing destructive integrity impact.

4) Post-exploitation impact: The attacker can map the victim's document-store and vector-store architecture, potentially obtaining credentials or endpoints embedded in node parameter values. The destructive variant allows an attacker to silently delete upsert history for targeted chatflows, disrupting RAG operations and corrupting data lineage.

No public exploit code, Nuclei template, or observed in-the-wild campaign is known at this time.

Impact Assessment

The vulnerability enables cross-tenant and cross-workspace data access and deletion in Flowise deployments. Under CVSS v3.1, the confidentiality impact is rated High (C:H), integrity impact High (I:H), and availability impact High (A:H). Attack complexity is rated High (AC:H) because exploitation requires knowledge of target chatflowId values or record UUIDs.

Business impact includes:

• Confidentiality breach: Exposure of node paramValues that may contain credentials, API keys, database URIs, embedding service tokens, and sensitive document-processing configuration.
• Integrity loss: Unauthorized deletion of upsert history records via patchDeleteUpsertHistory(), which can disrupt document-store synchronization and corrupt operational state.
• Multi-tenant blast radius: Because no workspace validation is performed, a low-privilege user in one workspace can affect records in any other workspace where the chatflowId is known.
• Regulatory exposure: Exposed configuration data may include PII processed through RAG pipelines, triggering data protection obligations.

The CVSS attack vector is Network (AV:N) with Low privileges required (PR:L) and no user interaction (UI:N), meaning any authenticated user with an API key can attempt exploitation.

Detection Guidance

Sigma Rule

title: Flowise Upsert History Unauthorized Access Attempt
id: 8f4a2c1e-9b3d-4e7a-a1c2-5f8d6e2b9c01
status: experimental
description: Detects requests to Flowise upsert-history endpoints that may indicate CVE-2026-100610 exploitation
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-100610
author: Threat Intelligence Team
date: 2026-01-01
logsource:
    category: webserver
    product: flowise
detection:
    selection_get:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/v1/upsert-history/'
    selection_patch:
        cs-method: 'PATCH'
        cs-uri-stem|startswith: '/api/v1/upsert-history'
    condition: selection_get or selection_patch
fields:
    - c-ip
    - cs-username
    - cs-uri-stem
    - cs-method
falsepositives:
    - Legitimate administrative access to owned upsert history
level: medium

YARA Rule

rule CVE_2026_100610_Flowise_UpsertHistory
{
    meta:
        description = "Detects Flowise upsert-history endpoint references indicative of CVE-2026-100610 activity"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100610"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "/api/v1/upsert-history/" ascii wide
        $ep2 = "/api/v1/upsert-history" ascii wide
        $m1 = "getAllUpsertHistory" ascii wide
        $m2 = "patchDeleteUpsertHistory" ascii wide
        $p1 = "chatflowid" ascii wide nocase
        $p2 = "flowData" ascii wide
        $p3 = "paramValues" ascii wide

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (any of ($ep1, $ep2)) or
        (2 of ($m1, $m2, $p1, $p2, $p3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100610 Flowise Upsert History Unauthorized Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/upsert-history/"; startswith; reference:cve,2026-100610; classtype:attempted-user; sid:2026100610; rev:1;)

alert http any any -> any any (msg:"CVE-2026-100610 Flowise Upsert History Unauthorized Delete Attempt"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/api/v1/upsert-history"; startswith; reference:cve,2026-100610; classtype:attempted-user; sid:2026100611; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where
      http.request.method == "GET" and
      http.request.path : "/api/v1/upsert-history/*" and
      process.name != null ]
  [ network where
      http.request.method == "PATCH" and
      http.request.path : "/api/v1/upsert-history*" and
      process.name != null ]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="/api/v1/upsert-history" OR uri_path="/api/v1/upsert-history/*")
| eval risk=case(http_method="PATCH", "high", http_method="GET", "medium", true(), "low")
| stats count min(_time) as first_seen max(_time) as last_seen values(http_method) as methods values(uri_path) as paths by src_ip user
| where count > 3
| sort - count
| table first_seen last_seen src_ip user methods paths count risk

Wazuh OSSEC Rule

<group name="flowise,web,access_control">
  <rule id="100610" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/v1/upsert-history</url>
    <description>CVE-2026-100610: Flowise upsert history endpoint accessed - possible unauthorized access</description>
    <group>cve_2026_100610,access_control,</group>
  </rule>

  <rule id="100611" level="12">
    <if_sid>100610</if_sid>
    <match>PATCH</match>
    <description>CVE-2026-100610: Flowise upsert history PATCH delete attempt - possible data destruction</description>
    <group>cve_2026_100610,integrity_attack,</group>
  </rule>

  <rule id="100612" level="12">
    <if_sid>100610</if_sid>
    <match>GET</match>
    <description>CVE-2026-100610: Flowise upsert history GET access - possible cross-workspace data exposure</description>
    <group>cve_2026_100610,data_exposure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• Restrict network access to the Flowise API to trusted networks only. Place Flowise behind an authenticating reverse proxy or API gateway that enforces per-user authorization on /api/v1/upsert-history and /api/v1/upsert-history/:id.
• Apply route-level access controls at the reverse proxy to reject requests where the authenticated user does not own the referenced chatflowid.
• Rotate any API keys, database credentials, embedding service tokens, or other secrets that may have been stored in node paramValues and potentially exposed.
• Audit logs for access to GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history from unexpected users or IPs.
• Disable public /chatbot/<chatflowId> share links where possible to reduce exposure of chatflowId values.

2) Patch/upgrade steps:

• No patched version is available. Monitor the Flowise project repository and vendor channels for a security release.
• When a patch is released, upgrade all Flowise instances to the patched version and re-test the affected endpoints for authorization enforcement.

3) Long-term hardening:

• Enforce workspace-scoped and ownership-based authorization at the service layer for all data-access methods, not only at the route level.
• Adopt a deny-by-default authorization model where client-supplied identifiers such as chatflowid and record UUIDs are never treated as sufficient authorization.
• Implement centralized multi-tenant isolation testing in CI/CD to catch CWE-639 class defects before release.
• Conduct regular review of any endpoint that accepts user-controlled keys for database lookups or deletions.

References

• NVD — CVE-2026-100610: https://nvd.nist.gov/vuln/detail/CVE-2026-100610
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Flowise project repository (monitor for security release): https://github.com/FlowiseAI/Flowise
• FIRST EPSS: not yet scored (no EPSS value available at time of writing)
• CISA Known Exploited Vulnerabilities catalog: not listed (as of report date)

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild campaign activity has been observed or reported for CVE-2026-100610 at this time.